On 1 July 2020, the enactment of the Protection of Personal Information Act (POPI Act) commenced, which will come into full effect on 1 July 2021. As its name states, the POPI Act aims to promote the safeguarding of personal information by putting in place the necessary regulations and legislation needed to realise this. Since its acceptance into parliament on 19 November 2013, the media has been flooded with the scope of the Act and how it will affect those who work with personal information. One industry that should not be overlooked during this time of preparation, is the real estate industry.
Personal information has always been a vital part of the real estate industry, and as such, the industry comprises various responsible parties that fall within the scope of the POPI Act. Estate agents, for one, use the data of their clients to better equip them in the search for their clients’ perfect homes, discerning the needs from the data. They also use this information to complete documentation such as lease agreements, FICA compliance affidavits, bond approvals, mortgage bond applications, and transfer deeds. So, it makes sense that estate agents must have access to as much personal information as possible. Conveyancers, who also work with the personal information of clients, often receive sensitive data from buyers, sellers, estate agents, insurers, auditors, homeowners’ associations and financial institutions. This information is regularly passed on to governmental bodies such as SARS, deeds offices and municipalities. As such, it is clear that the effect of the POPI Act will be unavoidable on the real estate market.
Who is the Responsible Party?
Simply put, a responsible party is anyone who is responsible for the processing of personal information, whether it be in the collection, safekeeping, or destruction of that information. They must ensure the integrity of every step taken during the processing of personal information, and must ensure that the conditions and regulations of the POPI Act are always adhered to. As part of their duties, responsible parties must put in place the necessary measures that safeguard information against any possible internal or external risks, and regularly update these safeguards to ensure up-to-date security. Where any third party is utilised by the Responsible Party to process any personal information on its/her/his behalf, the Responsible Party have further obligations under the POPI Act.
What are Data Subjects?
Data subjects are essentially any person whose personal information is collected or kept by the responsible parties. The POPI Act includes a non-exhaustive list of exactly what is considered personal information, which responsible parties must familiarise themselves with. The Act also includes the specific rights of data subjects, which aim to protect the personal information of all data subjects.
How will the Real Estate Industry be Affected?
The first step towards POPIA compliance may be the easiest.
Estate agents and conveyancers may only process personal information if i) the necessary consent has been obtained from the Data subject or (ii) processing is necessary to carry out the actions for the conclusion or performance of a contract to which the data subject is a party, or iii) processing complies with an obligation imposed by law on the Responsible Party, or iv) processing protects a legitimate interest of the Data Subject, or (v) processing is necessary for pursuing the legitimate interest of the Responsible Party or of a third party to whom the information is supplied.
Further, neither estate agents nor conveyancers may share a client’s information or pass it on to another organisation or body without the data subject’s written approval. This is especially important as there are various role-players involved in a property search and its subsequent sale. Estate agents will also not be able to hand over the information of tenants and interested buyers to landlords and sellers without the necessary policies having been set up and permissions gained.
Another big change will come in the way estate agencies conduct their direct marketing. From newsletters and campaigns to special offers and latest listings, agencies and agents will have to obtain the necessary permissions to continue with such communications. For many who receive such unwanted communication, this is a welcome change – one less “spam” email you have to delete before even opening it. But for those who benefit from such communications, the additional steps that need to be taken to ensure that they continue to receive the latest news and developments is vital.
The most important part is, the POPI Act puts the decision of what information is given out back in the hands of the individual to whom the information belongs. Whatever way you look at it, that’s something good.
Compliance by estate agents and conveyancers of the POPI Act will not only steer them away from possible regulatory penalties or possible suspension of operations, but will increase their changes for a better sale of their services to the Data Subject, their clients.
For more information you can contact our Data protection specialists at: firstname.lastname@example.org.
Gerrie van Gaalen – Tyger Valley
Download vCard: Gerrie van Gaalen
This article is for general information purposes and should not be used or relied on as legal or other professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact us At DKVG Attorneys for specific and detailed advice.